Bug 26142 - mariadb new security issues (fixed in 10.3.22)
Summary: mariadb new security issues (fixed in 10.3.22)
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA7-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2020-01-29 01:35 CET by Marc Krämer
Modified: 2020-01-30 19:30 CET (History)
4 users (show)

See Also:
Source RPM:
CVE:
Status comment:


Attachments

Description Marc Krämer 2020-01-29 01:35:14 CET
new security issue was found and fixed
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2574
Marc Krämer 2020-01-29 01:35:36 CET

QA Contact: (none) => security
Component: RPM Packages => Security

Comment 1 David Walser 2020-01-29 03:08:53 CET
https://mariadb.com/kb/en/mariadb-10322-release-notes/

Summary: new security issues in MariaDB => mariadb new security issues (fixed in 10.3.22)

Comment 2 Marc Krämer 2020-01-29 09:12:07 CET
Updated MariaDB packages fix security vulnerabilities:

Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. [1]

In addtion a new pam subpackge is provided which adds prebuilt pam_user_map [2].

All release notes can be found here [3]

References:
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2574
[2] https://mariadb.com/kb/en/authentication-plugin-pam/
[3] https://mariadb.com/kb/en/mariadb-10322-release-notes/
========================

Updated packages in core/updates_testing:
========================
mariadb-10.3.22-1.mga7
mysql-MariaDB-10.3.22-1.mga7
mariadb-feedback-10.3.22-1.mga7
mariadb-connect-10.3.22-1.mga7
mariadb-sphinx-10.3.22-1.mga7
mariadb-mroonga-10.3.22-1.mga7
mariadb-sequence-10.3.22-1.mga7
mariadb-spider-10.3.22-1.mga7
mariadb-extra-10.3.22-1.mga7
mariadb-obsolete-10.3.22-1.mga7
mariadb-core-10.3.22-1.mga7
mariadb-common-core-10.3.22-1.mga7
mariadb-common-10.3.22-1.mga7
mariadb-client-10.3.22-1.mga7
mariadb-bench-10.3.22-1.mga7
mariadb-pam-10.3.22-1.mga7
libmariadb3-10.3.22-1.mga7
libmariadb-devel-10.3.22-1.mga7
libmariadbd19-10.3.22-1.mga7
libmariadb-embedded-devel-10.3.22-1.mga7
mariadb-debugsource-10.3.22-1.mga7
mariadb-debuginfo-10.3.22-1.mga7
mariadb-feedback-debuginfo-10.3.22-1.mga7
mariadb-connect-debuginfo-10.3.22-1.mga7
mariadb-sphinx-debuginfo-10.3.22-1.mga7
mariadb-mroonga-debuginfo-10.3.22-1.mga7
mariadb-sequence-debuginfo-10.3.22-1.mga7
mariadb-spider-debuginfo-10.3.22-1.mga7
mariadb-extra-debuginfo-10.3.22-1.mga7
mariadb-obsolete-debuginfo-10.3.22-1.mga7
mariadb-core-debuginfo-10.3.22-1.mga7
mariadb-common-debuginfo-10.3.22-1.mga7
mariadb-client-debuginfo-10.3.22-1.mga7
mariadb-bench-debuginfo-10.3.22-1.mga7
mariadb-pam-debuginfo-10.3.22-1.mga7
libmariadb3-debuginfo-10.3.22-1.mga7
libmariadbd19-debuginfo-10.3.22-1.mga7
libmariadb-embedded-devel-debuginfo-10.3.22-1.mga7

Source RPMs: 
mariadb-10.3.22-1.mga7.src.rpm

Assignee: mageia => qa-bugs

Comment 3 Herman Viaene 2020-01-30 10:49:24 CET
MGA7-64 Plasma on Lenovo B50
No installation issues, leaving out all evvel and debug packages.
This was an update on an existin installation, used phpmyadmin to test.
Recognized previous databases, created in an otherwise empty database a new table with a primary key on kol1 and a unique index and kol2.
All is OK.

CC: (none) => herman.viaene
Whiteboard: (none) => MGA7-64-OK

Comment 4 Thomas Andrews 2020-01-30 15:59:53 CET
Validating. Advisory in Comment 2.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Thomas Backlund 2020-01-30 18:43:03 CET

Keywords: (none) => advisory
CC: (none) => tmb

Comment 5 Mageia Robot 2020-01-30 19:30:01 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2020-0072.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.